5015f3dd43
C-1: Keycloak driver now verifies JWT signatures via JWKS.
Forged tokens are rejected. Previously any base64 JWT was accepted.
C-2: on_behalf_of requires gsap:impersonate role in JWT claims.
C-3: Entra driver denies on JWKS failure (no unverified fallback).
H-10: JWKS cache refreshes on kid miss for key rotation.
Shared JWKSVerifier used by both drivers. alg=none blocked.
iss, aud, exp validated for all tokens.
Signed-off-by: Tyler King <tking@guildhouse.dev>
|
||
|---|---|---|
| .. | ||
| __init__.py | ||
| conftest.py | ||
| test_broker.py | ||
| test_compliance_gate.py | ||
| test_connectors.py | ||
| test_credentials.py | ||
| test_entra_driver.py | ||
| test_functions.py | ||
| test_graph_client.py | ||
| test_intune.py | ||
| test_keycloak_driver.py | ||
| test_mcp_intune.py | ||